Encryption and sessions¶
Passwords and authentication¶
Passwords are stored as hashes, never in clear text. TOTP two-factor authentication is available per user. LDAP/AD and OIDC delegate authentication to the provider.
Field encryption¶
Sensitive configuration fields can be encrypted with a Fernet key. Key rotation is available to administrators. Rotate keys carefully: existing ciphertext must be re-encrypted with the new key.
Stored documents¶
Storage can use local files or MinIO/S3. Optional encryption at rest depends on the deployment. Content-addressed storage and duplicate detection are used for blobs.
Secrets¶
Integration secrets include the session secret, the API-key HMAC pepper, and the BPM shared key. Store them in the deployment's secret manager, not in source control, and rotate them on a schedule.
Sessions and browser security¶
- Server-side sessions are stored in Redis.
- Browser requests use CSRF protection.
- A Content Security Policy with nonces restricts scripts.
- Embedded BPM sessions can be read-only.
- TLS is required for production.
SAML¶
SAML is a scaffold in this version. Use local, LDAP/AD, or OIDC authentication.